Access to Prometheus metrics

The Remnawave panel exposes metrics in Prometheus format on a dedicated port 3001. During installation the script generates a random login and password for them and binds the port to localhost: the address is not reachable from outside the server, which keeps the metrics away from strangers.

The ### PROMETHEUS ### section in /opt/remnawave/.env, generated at installation.

Metrics address

http://127.0.0.1:3001/metrics with basic HTTP authentication.

Access

Localhost only: the port in docker-compose.yml is bound to 127.0.0.1.

Connection data

The script generates a random login and password and writes them into the panel’s .env:

### PROMETHEUS ###
### Metrics are available at http://127.0.0.1:METRICS_PORT/metrics
METRICS_USER=gjlToiPH
METRICS_PASS=VsCNutHF

The file lives at /opt/remnawave/.env; the panel container picks the values up automatically.

Variable	Purpose	Script value
`APP_PORT`	Panel port	`3000` (inside Docker only)
`METRICS_PORT`	Metrics port	`3001`, bound to `127.0.0.1`
`METRICS_USER`	Metrics login	random
`METRICS_PASS`	Metrics password	random
`APP_SECRET`	Signing key for sessions and API tokens	random

Quick check

On the server itself the metrics are one command away (the response is in Prometheus text format):

curl -u gjlToiPH:VsCNutHF http://127.0.0.1:3001/metrics | head

From your own computer the endpoint can be reached through an SSH tunnel, without opening the port to the world:

ssh -L 3001:127.0.0.1:3001 root@your_server_ip

After that http://127.0.0.1:3001/metrics also opens in the local browser.

Scraper configuration

The metrics must be pulled from the server itself, straight from 127.0.0.1. A config for vmagent (the one the monitoring guide uses):

- job_name: remnawave
  scrape_interval: 15s
  static_configs:
    - targets: ['127.0.0.1:3001']
      labels:
        instance: "your_instance_name"
  basic_auth:
    username: "gjlToiPH"
    password: "VsCNutHF"

For classic Prometheus the section looks the same:

scrape_configs:
  - job_name: 'remnawave'
    scheme: http
    metrics_path: /metrics
    scrape_interval: 15s
    static_configs:
      - targets: ['127.0.0.1:3001']
    basic_auth:
      username: gjlToiPH
      password: VsCNutHF

Why the metrics are not visible from outside

The script publishes the metrics port on localhost only:

ports:
  - '127.0.0.1:3001:3001'

Direct access from outside is therefore impossible, and, unlike the panel login page, it cannot be bypassed with a cookie: the metrics have their own protection (port binding plus basic auth). There are two ways to pull them from the outside: an agent running on the server itself (vmagent or Prometheus with remote_write), or the SSH tunnel shown above.

Monitoring with Grafana and Victoria MetricsA complete monitoring set: metrics from the panel, nodes and containers, plus Grafana dashboards.